Virus/malware assistance needed

I just had a user that had the reply to box changed without their knowledge. I search for a virus or exe that could do this but was unable to.

It happened yesterday morning and was noticed immediately, we use Zimbra for the webmail and it is buried in the preferences for emails accounts. So while not a common area, I could not find anything that is actually able to check a box labeled "send all replies to" and then fill in the address box.

Someone could have guessed the username and password on the account, your provider could have been hacked, or had a list of passwords stolen. I assume you already changed the password on their account.